146 citations · 1.1k across the 129 of their papers we have counts for
133 papers
Practical Secrets Extraction against Black-box LLMs
Shiqian Zhao, Siwei Jiang, Xinfeng Li +5
Large language models (LLMs) increasingly power autonomous coding agents such as Codex and Claude Code, yet their training corpora may contain confidential credentials exposed in p…
SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs
Haoran Ou, Gelei Deng, Xuanye Zhang +3
As LLM-based agents perform increasingly complex tasks, Agent Skills have emerged as a flexible mechanism for extending their capabilities. An Agent Skill packages task-specific in…
ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems
Shiqian Zhao, Yangfan Zhou, Xinfeng Li +5
Recently, large language model (LLM) agents, such as Codex, Claude Code, and OpenClaw, have become capable of planning and executing long-horizon tasks through repeated tool calls.…
Efficient Fuzzy PSI under One-Sided Assumptions
Xinpeng Yang, Meng Hao, Yanxue Jia +3
Fuzzy private set intersection (PSI) enables two parties to identify approximately matching elements between their input sets, where two elements are considered a match if their di…
Auditing Chinese Web-scale Corpora via Sampled BPE Token Statistics
Qingjie Zhang, Ziqi Tang, Jie Zhang +7
Chinese web pollution has surfaced in LLMs, motivating audits of upstream Chinese corpora. However, auditing such corpora faces three challenges: (1) their web-scale size makes ful…
INTENT-AS-A-TOOL Makes it Easy to Track Agentic Misalignment
Yutong Zhang, Jianshuo Dong, Peng Xu +5
As large language models (LLMs) are deployed as autonomous agents, safety failures increasingly involve consequential actions. We study agentic misalignment, where agents take harm…
Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States
Jianshuo Dong, Yiming Liu, Maosen Zhang +6
Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.g., malicious side-tasks hidden in external tool results. While many efforts have sought to address this t…
The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges
Maosen Zhang, Jianshuo Dong, Boting Lu +5
LLMs increasingly rely on external contexts, such as pre-defined system prompts or retrieved documents, to improve generation quality. However, processing these contexts alongside…
Towards Scalable Fuzzy PSI via Efficient Fuzzy Matching
Meng Hao, Xinpeng Yang, Hanxiao Chen +5
In this paper, we present scalable fuzzy PSI protocols for general distance, supporting both low- and high-dimensional sets. The core technique is two effic…
ASCon: A Direction-Aware Reciprocal Agent--Step Contextualization Model for Failure Attribution in Multi-Agent Systems
Shuyu Jiang, Yue Ran, Kaiyu Xu +5
Failure attribution in LLM-based multi-agent systems (MAS) aims to answer who caused failures, when they occurred, and why by identifying responsible targets including faulty agent…
Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents
Zihao Wang, Yiming Li, Yutong Wu +8
LLM-based web agents are increasingly deployed in real-world settings such as e-commerce, where they interact extensively with untrusted web content while executing actions that ca…
Self-Improving is Often Sudden: Enlightenment-style Finetuning for Large-Scale Models
Jing-Xiao Liao, Tianwei Zhang, Yu-Hao Jiang +3
The pursuit of autonomously self-improving models has attracted growing interest in the era of large-scale foundation models. Drawing inspiration from the concept of "enlightenment…
When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents
Yechao Zhang, Shiqian Zhao, Jiawen Zhang +5
Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. Thi…
GR2 Technical Report
Yufei Li, Zaiwei Zhang, Mingfu Liang +67
Industrial recommendation systems serve billions of users through a multi-stage funnel -- retrieval, early-stage ranking, and re-ranking -- where the final re-ranking step dispropo…
Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies
Ruixiao Lin, Xinhao Deng, Qingming Li +12
Self-evolving LLM agent systems, which autonomously update their model parameters, memory, tools, and architectures, introduce a qualitatively new threat landscape in which adversa…
Communication-Efficient Verifiable Attention for LLM Inference
Ziqun Chen, Ming Wu, Michael Heinrich +4
Computation integrity of remote large language model (LLM) serving can be questionable. For conventional deep neural networks (DNNs), the existing TEE-shielded DNN partitioning (TS…
Beyond Similarity: Trustworthy Memory Search for Personal AI Agents
Jiawen Zhang, Kejia Chen, Jiachen Ma +7
Personal AI agents increasingly rely on long-term memory to provide persistent personalization across sessions. However, existing memory pipelines are largely driven by semantic si…
One Jailbreak, Many Tongues: Learning Language-Insensitive Intention Representations for Multilingual Jailbreak Detection
Shuyu Jiang, Kaiyu Xu, Xingshu Chen +5
Large language models (LLMs) are increasingly deployed in applications for global multilingual users, yet safety training remains concentrated in dominant languages and has not pro…
Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges
Xianglin Yang, Bryan Hooi, Gelei Deng +2
The known stylistic biases in LLM judges, such as a preference for verbosity or specific sentence structures, present an underexplored security vulnerability. In this work, we intr…
MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning
Xuanye Zhang, Yongsen Zheng, Zhuqin Xu +5
LLM-driven agents are capable of selecting external tools to complete users' tasks. However, attackers could compromise such process, steering agents toward inappropriate/wrong too…
Capacitive Touchscreens at Risk: A Practical Side-Channel Attack on Smartphones via Electromagnetic Emanations
Yukun Cheng, Changhai Ou, Shiyu Zhu +6
Capacitive touchscreens in modern smartphones introduce severe side-channel vulnerabilities. However, existing attacks often require restrictive conditions or invasive measurements…
Mitigating Many-shot Jailbreak Attacks with One Single Demonstration
Kejia Chen, Jiawen Zhang, Boheng Li +6
Many-shot jailbreaking (MSJ) causes safety-aligned language models to answer harmful queries by preceding them with many harmful question-answer demonstrations. We study why this a…
LeakDojo: Decoding the Leakage Threats of RAG Systems
Maosen Zhang, Jianshuo Dong, Boting Lu +4
Retrieval-Augmented Generation (RAG) enables large language models (LLMs) to leverage external knowledge, but also exposes valuable RAG databases to leakage attacks. As RAG systems…
State-Dependent Safety Failures in Multi-Turn Language Model Interaction
Pengcheng Li, Jie Zhang, Tianwei Zhang +5
Safety alignment in large language models is typically evaluated under isolated queries, yet real-world use is inherently multi-turn. Although multi-turn jailbreaks are empirically…